vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
refactor
c5902451905acdaa478f8476844ccd4a510d9ca9 · Keenan Nemetz · 16d ago · parent ec2aba4b
internal/sshserver/lfs.go → server/ssh/lfs.go +8−8
| @@ -1,14 +1,14 @@ | |||
| 1 | package sshserver | ||
| 1 | package ssh | ||
| 2 | 2 | ||
| 3 | 3 | import ( | |
| 4 | 4 | "fmt" | |
| 5 | 5 | "strconv" | |
| 6 | 6 | "time" | |
| 7 | 7 | ||
| 8 | "golang.org/x/crypto/ssh" | ||
| 8 | xssh "golang.org/x/crypto/ssh" | ||
| 9 | 9 | ||
| 10 | "github.com/rodent-software/vole/internal/acl" | ||
| 11 | "github.com/rodent-software/vole/internal/lfs" | ||
| 10 | "github.com/rodent-software/vole/core/lfs" | ||
| 11 | "github.com/rodent-software/vole/forge/access" | ||
| 12 | 12 | ) | |
| 13 | 13 | ||
| 14 | 14 | // serveLFS runs a git-lfs transfer session: `ssh host git-lfs-transfer <repo> | |
| @@ -16,7 +16,7 @@ import ( | |||
| 16 | 16 | // the same read rule the web and clone use — but resolved against the account | |
| 17 | 17 | // that owns the key, so a private repository's members can pull objects over | |
| 18 | 18 | // SSH while anonymous readers cannot. | |
| 19 | func (s *Server) serveLFS(ch ssh.Channel, req *ssh.Request, pathArg, op, user, accountID string) { | ||
| 19 | func (s *Server) serveLFS(ch xssh.Channel, req *xssh.Request, pathArg, op, user, accountID string) { | ||
| 20 | 20 | refuse := func(format string, args ...any) { | |
| 21 | 21 | req.Reply(true, nil) | |
| 22 | 22 | fmt.Fprintf(ch, "vole: "+format+"\n", args...) | |
| @@ -48,8 +48,8 @@ func (s *Server) serveLFS(ch ssh.Channel, req *ssh.Request, pathArg, op, user, a | |||
| 48 | 48 | return | |
| 49 | 49 | } | |
| 50 | 50 | role := a.RoleFor(accountID) | |
| 51 | canRead := a.Can(accountID, acl.Read) | ||
| 52 | canWrite := role.AtLeast(acl.Write) | ||
| 51 | canRead := a.Can(accountID, access.Read) | ||
| 52 | canWrite := role.AtLeast(access.Write) | ||
| 53 | 53 | if op == "upload" && !canWrite { | |
| 54 | 54 | s.cfg.Log.Warn("ssh: refused lfs upload", "user", user, "repo", name, "role", role) | |
| 55 | 55 | refuse("%s does not have write access to %s (role: %s)", user, name, role) | |
| @@ -75,7 +75,7 @@ func (s *Server) serveLFS(ch ssh.Channel, req *ssh.Request, pathArg, op, user, a | |||
| 75 | 75 | CanWrite: canWrite, | |
| 76 | 76 | // Releasing somebody else's lock is an admin act, the same rule a force-push | |
| 77 | 77 | // follows: the alternative is a lock nobody can clear once its holder leaves. | |
| 78 | IsAdmin: role.AtLeast(acl.Admin), | ||
| 78 | IsAdmin: role.AtLeast(access.Admin), | ||
| 79 | 79 | Locks: s.cfg.Locks, | |
| 80 | 80 | Names: s.cfg.Identity.Name, | |
| 81 | 81 | Log: s.cfg.Log, | |